Detections
Analytics

1.58 ALMA-09-009370

Information

AlmaLinux OS 9 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.

GROUP ID: V-269161
RULE ID: SV-269161r1050043

GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system.

Solution

Configure the SSH daemon to not allow GSSAPI authentication.

Add the following line to "/etc/ssh/sshd_config", or uncomment the line and set the value to "no":

GSSAPIAuthentication no

Alternatively, add the setting to an included file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file:

GSSAPIAuthentication no

Restart the SSH daemon for the settings to take effect:

$ systemctl restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-5(1), CCI|CCI-001813, Rule-ID|SV-269161r1050043_rule, STIG-ID|ALMA-09-009370, Vuln-ID|V-269161

Plugin: Unix

Control ID: cdf5710bfc672d52af3e76a823223f8919e98f9bcffd46658ef7ad0388fd93b7